Your solution looks a lot like FreeBSD's portupgrade, or Gentoo's
emerge.  While these may be pretty damn handy tools, they still have
disadvantages.  Even with smart dependency-ordering, the running system
may be unstable/ unusable during the update.  And when a build fails and
the old package is restored in place, you could suffer from binary
incompatibilities if some dependendancies have already been upgraded.  

What would be best, in my opinion, is a frontend to combine pkg_chk and
pkg_comp.  Using pkg_comp, you can just nuke the to-be-updated packages
in the chroot, and rebuild them from scratch, according to pkgchk.conf.
Nothing gets rebuild twice, no advanced dependecy ordering required.
Also, the running system just keeps running.  When a build breaks,
nothing is damaged.  And only when each package has finished building,
the admin starts a binary upgrade.  Two big advantages: not only the
downtime is minimized to five minutes or so, but also the "risky part",
which has to be carefully monitored by the sysadmin.  e.g., he can start
the massive sandboxed build on friday night (unmonitored), and can do
the actual upgrade on monday morning (after his coffee, of course).  

Major disadvantage: pkg_comp is quite OS dependant, and probably not
easy port.  But at least we could have a working solution for NetBSD.  

GH

-- 
:wq